paul/picpeak
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

fix(customer): preserve slug-scoped gallery tokens on auth provider mount

Browse Source
This commit is contained in:
Luca
2026-05-11 11:32:59 +02:00
parent bf7ef14626
commit 7ac1d14738
1 changed files with 31 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files
frontend/src/utils/cleanupGalleryAuth.ts
+31 -36
View File
@@ -1,42 +1,37 @@
// Cleanup function to remove old gallery authentication data /**
* Cleanup helper for legacy gallery-auth artefacts.
*
* Removes pre-multi-gallery storage:
* - global `gallery_token` / `gallery_event` keys in localStorage AND
* sessionStorage (the old single-gallery shape).
* - the bare `gallery_token` cookie (now replaced by slug-scoped
* `gallery_token_<slug>` cookies).
*
* Does NOT wipe slug-scoped sessionStorage entries any more — the
* previous version did, which broke the customer-dashboard → gallery
* handoff. CustomerDashboardPage stores
* `sessionStorage.gallery_token_<slug>` immediately before navigating
* to /gallery/<slug>; GalleryAuthProvider then mounts and ran this
* cleanup as its first effect, wiping the just-set entry and forcing
* the user back to the per-event password prompt even though their
* customer JWT had just been exchanged for a valid gallery JWT.
*
* Slug-scoped storage is owned by GalleryAuthProvider itself (cleared
* on logout, token invalidation, archived event) — this helper has
* no business sweeping it.
*/
export const cleanupOldGalleryAuth = () => { export const cleanupOldGalleryAuth = () => {
// Remove old global gallery authentication // Legacy global keys (pre-multi-gallery shape).
localStorage.removeItem('gallery_event'); localStorage.removeItem('gallery_event');
localStorage.removeItem('gallery_token'); // Remove old global token format localStorage.removeItem('gallery_token');
// Remove any corrupted or old gallery tokens from localStorage
const keysToRemove: string[] = [];
for (let i = 0; i < localStorage.length; i++) {
const key = localStorage.key(i);
if (key && (key.startsWith('gallery_token') || key.startsWith('gallery_event'))) {
keysToRemove.push(key);
}
}
keysToRemove.forEach(key => {
localStorage.removeItem(key);
});
// Remove old gallery token from cookies if it exists
document.cookie = 'gallery_token=; expires=Thu, 01 Jan 1970 00:00:00 UTC; path=/;';
// Also clear session storage
sessionStorage.removeItem('gallery_event'); sessionStorage.removeItem('gallery_event');
sessionStorage.removeItem('gallery_token'); sessionStorage.removeItem('gallery_token');
// Legacy bare cookie (path=/, no slug suffix). Slug-scoped
// `gallery_token_<slug>` cookies are kept — they're how the customer
// dashboard hands off auth to /gallery/<slug>.
document.cookie = 'gallery_token=; expires=Thu, 01 Jan 1970 00:00:00 UTC; path=/;';
// gallery_active_slug is a UI hint, not auth. Safe to drop.
sessionStorage.removeItem('gallery_active_slug'); sessionStorage.removeItem('gallery_active_slug');
// Remove slug-specific session storage entries as well
try {
const sessionKeysToRemove: string[] = [];
for (let i = 0; i < sessionStorage.length; i += 1) {
const key = sessionStorage.key(i);
if (key && (key.startsWith('gallery_event_') || key.startsWith('gallery_token_'))) {
sessionKeysToRemove.push(key);
}
}
sessionKeysToRemove.forEach((key) => sessionStorage.removeItem(key));
} catch {
// Session storage may be unavailable; ignore cleanup failures
}
}; };